Having discovered a wave of surveillance campaigns in several countries in summer 2017, ESET researchers dug deep into the samples of FinFisher. To be able to start a thorough analysis of how these recent samples work, they first had to break through all FinFisher’s protective layers.

To help malware analysts and security researchers overcome FinFisher’s advanced anti-disassembly obfuscation and virtualization features, ESET researchers have framed some clever tricks into a whitepaper, “ESET’s guide to deobfuscating and devirtualizing FinFisher”. 

“The company behind FinFisher has built a multimillion-dollar business around this spyware – so it comes as no surprise that they put a much bigger effort into hiding and obfuscation than most common cybercriminals. Our aim is to help our peers analyze FinFisher and thus protect internet users from this threat,” comments Filip Kafka, ESET malware analyst who leads the analysis of FinFisher.

Filip Kafka expects the FinFisher creators to improve their protections to make FinFisher hard to analyze again. “With their huge resources, there is no doubt FinFisher will receive even better anti-analysis features. However, I expect their additional measures to cost more to implement while being easier to crack for us the next time around,” comments Filip Kafka.

ESET’s analysis into FinFisher is ongoing. In the first stage, ESET researchers focused on the infection vector used in the mentioned campaigns. They strongly believe internet service providers have played the key role in infecting the victims with FinFisher. Filip Kafka’s presentations of these findings along with a brief overview of FinFisher’s anti-analysis capabilities raised a lot of interest at the Virus Bulletin Conference as well as the AVAR conference.